netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-45v9-w9fh-33j6
GHSA-7pq6-v88g-wf3w
GHSA-c873-wfhp-wx5m
GHSA-45v9-w9fh-33j6
This commit is contained in:
advisory-database[bot]
2025-01-15 21:26:53 +00:00
parent e1e9d4c6a7
commit f4a6aa8f08
4 changed files with 259 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2025/01/GHSA-45v9-w9fh-33j6/GHSA-45v9-w9fh-33j6.json
+146
View File
@@ -0,0 +1,146 @@
{
"schema_version": "1.4.0",
"id": "GHSA-45v9-w9fh-33j6",
"modified": "2025-01-15T21:25:35Z",
"published": "2025-01-15T18:30:58Z",
"aliases": [
"CVE-2025-20088"
],
"summary": "Mattermost fails to properly validate post props",
"details": "Mattermost versions 10.2.x <= 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, 10.1.x <= 10.1.3 fail to properly validate post props which allows a malicious authenticated user to cause a crash via a malicious post.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost/server/v8"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "10.2.0"
},
{
"fixed": "10.2.1"
}
]
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost/server/v8"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "10.1.0"
},
{
"fixed": "10.1.4"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 10.1.3"
}
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost/server/v8"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "10.0.0"
},
{
"fixed": "10.0.4"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 10.0.3"
}
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost/server/v8"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "9.11.0"
},
{
"fixed": "9.11.6"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 9.11.5"
}
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost/server/v8"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.0-20241127161322-25ff7a3779a5"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-20088"
},
{
"type": "PACKAGE",
"url": "https://github.com/mattermost/mattermost"
},
{
"type": "WEB",
"url": "https://mattermost.com/security-updates"
}
],
"database_specific": {
"cwe_ids": [
"CWE-1287"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2025-01-15T21:25:35Z",
"nvd_published_at": "2025-01-15T17:15:19Z"
}
}
advisories/github-reviewed/2025/01/GHSA-7pq6-v88g-wf3w/GHSA-7pq6-v88g-wf3w.json
+65
View File
@@ -0,0 +1,65 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7pq6-v88g-wf3w",
"modified": "2025-01-15T21:25:27Z",
"published": "2025-01-15T21:25:27Z",
"aliases": [
"CVE-2025-22146"
],
"summary": "Sentry's improper authentication on SAML SSO process allows user impersonation",
"details": "### Impact\nA critical vulnerability was discovered in the SAML SSO implementation of Sentry. It was reported to us via our private bug bounty program.\n\nThe vulnerability allows an attacker to take over any user account by using a malicious SAML Identity Provider and another organization on the same Sentry instance. The victim email address must be known in order to exploit this vulnerability.\n\n### Patches\n- [Sentry SaaS](https://sentry.io): The fix was deployed on Jan 14, 2025.\n- [Self-Hosted Sentry](https://github.com/getsentry/self-hosted): If only a single organization is allowed (`SENTRY_SINGLE_ORGANIZATION = True`), then no action is needed. Otherwise, users should upgrade to version 25.1.0 or higher.\n\n### Workarounds\nNo known workarounds.\n\n### References\n- https://github.com/getsentry/sentry/pull/83407",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
}
],
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "sentry"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "21.12.0"
},
{
"fixed": "25.1.0"
}
]
}
]
}
],
"references": [
{
"type": "WEB",
"url": "https://github.com/getsentry/sentry/security/advisories/GHSA-7pq6-v88g-wf3w"
},
{
"type": "WEB",
"url": "https://github.com/getsentry/sentry/pull/83407"
},
{
"type": "WEB",
"url": "https://github.com/getsentry/sentry/commit/6db508f7949d117c7dff748a3c82c3a272bf7cfd"
},
{
"type": "PACKAGE",
"url": "https://github.com/getsentry/sentry"
}
],
"database_specific": {
"cwe_ids": [
"CWE-287"
],
"severity": "CRITICAL",
"github_reviewed": true,
"github_reviewed_at": "2025-01-15T21:25:27Z",
"nvd_published_at": null
}
}
advisories/github-reviewed/2025/01/GHSA-c873-wfhp-wx5m/GHSA-c873-wfhp-wx5m.json
+48
View File
File diff suppressed because one or more lines are too long
advisories/unreviewed/2025/01/GHSA-45v9-w9fh-33j6/GHSA-45v9-w9fh-33j6.json
-36
View File
@@ -1,36 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-45v9-w9fh-33j6",
"modified": "2025-01-15T18:30:58Z",
"published": "2025-01-15T18:30:58Z",
"aliases": [
"CVE-2025-20088"
],
"details": "Mattermost versions 10.2.x <= 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, 10.1.x <= 10.1.3 fail to properly validate post props which allows a malicious authenticated user to cause a crash via a malicious post.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-20088"
},
{
"type": "WEB",
"url": "https://mattermost.com/security-updates"
}
],
"database_specific": {
"cwe_ids": [
"CWE-1287"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-15T17:15:19Z"
}
}